Google Agrees To Change Privacy Policy In Settlement With UK's Information Commissioner
While Google continues to work through the best implementation of Right To Be Forgotten legislation in Europe, some more developments in the area of consumer data and privacy.
Context & Ripple Effects
This 2015 settlement is an early entry point in a long arc of regulators extracting written commitments from Google rather than fining it outright: the UK's Information Commissioner wins a changed privacy policy, and the same negotiation playbook recurs years later in the CMA's expanded oversight of Privacy Sandbox and the DOJ settlement over Google's legal-demands compliance program.
Between those endpoints, GDPR forced the 2018 privacy-policy rewrite that added clarity, data controls, and portability — meaning by the time of this article's aftermath, policy changes had shifted from something regulators extracted one-off to something European law required continuously.
First-order effects
- UK users get a revised Google privacy policy under terms negotiated with the Information Commissioner, making this one of the first instances where a national data authority directly dictated changes to Google's consumer-facing policy wording.
Second-order effects
- Other regulators gain a working template: negotiated commitments become the enforcement instrument of choice against Google, resurfacing in the CMA's antitrust oversight and the DOJ's compliance-program demands rather than stopping at fines.
- Each settlement raises the cost floor for Google's privacy operations — policy drafting, controls, and compliance programs must now satisfy multiple national authorities whose requirements compound rather than substitute for each other.
Third-order effects
- If the pattern holds, platform data practices stop being purely corporate policy documents and become quasi-regulated artifacts co-drafted with authorities in each major jurisdiction — a structure that predates and then hardens under GDPR-era obligations.
The trend: Regulators are converging on negotiated, audited commitments — not just penalties — as the standard mechanism for governing how large platforms write and change their privacy policies.